Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-51896 CVE record

CVSS 6.5 Medium

infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py).
- Broken access control
Not analysed yet 1 Oct 2026
CVE-2026-51895 CVE record

CVSS 6.5 Medium

Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py).
- Broken access control
Not analysed yet 1 Oct 2026
CVE-2026-51894 CVE record

CVSS 6.5 Medium

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap.
- Broken access control
Not analysed yet 1 Oct 2026
CVE-2026-51893 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap.
- Broken access control
Not analysed yet 1 Oct 2026
CVE-2026-51892 CVE record

CVSS 6.5 Medium

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>.
- Broken access control
Not analysed yet 1 Oct 2026
CVE-2026-51879 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file.
- Broken access control
Not analysed yet 1 Oct 2026
CVE-2026-51878 CVE record

CVSS 4.3 Medium

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate_last_turn.
- Broken access control
Not analysed yet 1 Oct 2026
CVE-2026-51876 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow.
- Broken access control
Not analysed yet 1 Oct 2026
CVE-2026-102107 CVE record

CVSS 4.6 Medium

Kiteworks Core user impersonation in a file-request feature
- Kiteworks Core
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-102122 CVE record

CVSS 4.3 Medium

Kiteworks Core Incorrect Authorization
- Kiteworks Core
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-102132 CVE record

CVSS 7.2 High

Kiteworks Core Privilege Escalation through Improper Access Control
- Kiteworks Core
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-102139 CVE record

CVSS 6.5 Medium

Kiteworks Email Protection Gateway Incorrect Authorization
- Kiteworks Email Protection Gateway
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-103547 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Incorrect authorization in OpenBSD
- OpenBSD
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-101880 CVE record

CVSS 8.7 High

OpenClaw Windows Node before 2026.7.1 Authorization Bypass
- OpenClaw Windows Node
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-101879 CVE record

CVSS 7.1 High

OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
- OpenClaw Windows Node
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-102375 CVE record

CVSS 6.5 Medium

WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability
- Optimole
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-102397 CVE record

CVSS 6.5 Medium

WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability
- Ultimate Maps by Supsystic
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-103476 CVE record

CVSS 6.9 Medium

yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download
- yii2-starter-kit
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-103446 CVE record

CVSS 7.4 High

WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
- The Wikimedia Foundation MediaWiki WikiLambda extension
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-55494 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset
- Quenary tugtainer
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-55181 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false
- Quenary tugtainer
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-55176 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token
- Soft-Machine-io security
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-103233 CVE record

CVSS 5.3 Medium

AdithyaYelloju Restaurant-Management-System Admin Area admin authorization
- AdithyaYelloju Restaurant-Management-System
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-47493 CVE record

CVSS 7.8 High

Missing authorization in NVIDIA Virtual GPU Manager
- NVIDIA Virtual GPU Manager
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-47604 CVE record

CVSS 5.5 Medium

Missing authorization in NVIDIA GeForce and others
- NVIDIA GeForce
- NVIDIA RTX, Quadro, NVS
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-47603 CVE record

CVSS 5.5 Medium

Missing authorization in NVIDIA GeForce and others
- NVIDIA GeForce
- NVIDIA RTX, Quadro, NVS
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-47492 CVE record

CVSS 5.5 Medium

Missing authorization in NVIDIA GeForce and others
- NVIDIA GeForce
- NVIDIA RTX, Quadro, NVS
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-47518 CVE record

CVSS 6.0 Medium

Incorrect permission assignment in NVIDIA GeForce and others
- NVIDIA GeForce
- NVIDIA RTX, Quadro, NVS
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-47580 CVE record

CVSS 7.3 High

Missing authorization in NVIDIA GeForce and others
- NVIDIA GeForce
- NVIDIA RTX, Quadro, NVS
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-47591 CVE record

CVSS 7.8 High

Incorrect authorization in NVIDIA GeForce and others
- NVIDIA GeForce
- NVIDIA RTX, Quadro, NVS
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-47571 CVE record

CVSS 7.8 High

Incorrect authorization in NVIDIA GeForce and others
- NVIDIA GeForce
- NVIDIA RTX, Quadro, NVS
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-47559 CVE record

CVSS 7.8 High

Missing authorization in NVIDIA GeForce and others
- NVIDIA GeForce
- NVIDIA RTX, Quadro, NVS
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-47552 CVE record

CVSS 7.8 High

Missing authorization in NVIDIA GeForce and others
- NVIDIA GeForce
- NVIDIA RTX, Quadro, NVS
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100280 CVE record

CVSS 3.1 Low

Missing authorization in JetBrains YouTrack
- JetBrains YouTrack
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100278 CVE record

CVSS 4.9 Medium

Incorrect authorization in JetBrains YouTrack
- JetBrains YouTrack
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100277 CVE record

CVSS 8.9 High

Incorrect authorization in JetBrains YouTrack
- JetBrains YouTrack
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100276 CVE record

CVSS 5.9 Medium

Incorrect authorization in JetBrains YouTrack
- JetBrains YouTrack
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100273 CVE record

CVSS 8.2 High

Incorrect authorization in JetBrains YouTrack
- JetBrains YouTrack
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100272 CVE record

CVSS 4.9 Medium

Insecure direct object reference in JetBrains YouTrack
- JetBrains YouTrack
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100271 CVE record

CVSS 2.7 Low

Missing authorization in JetBrains YouTrack
- JetBrains YouTrack
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100270 CVE record

CVSS 3.3 Low

Incorrect authorization in JetBrains YouTrack
- JetBrains YouTrack
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100269 CVE record

CVSS 4.3 Medium

Missing authorization in JetBrains YouTrack
- JetBrains YouTrack
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100268 CVE record

CVSS 7.7 High

Insecure direct object reference in JetBrains YouTrack
- JetBrains YouTrack
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100266 CVE record

CVSS 7.7 High

Missing authorization in JetBrains Hub
- JetBrains Hub
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100262 CVE record

CVSS 7.6 High

Incorrect authorization in JetBrains YouTrack
- JetBrains YouTrack
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-100259 CVE record

CVSS 4.3 Medium

Incorrect authorization in JetBrains YouTrack
- JetBrains YouTrack
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-103396 CVE record

CVSS 5.3 Medium

bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount
- mlogclub bbs-go
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-97259 CVE record

CVSS 5.3 Medium

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability
- WP Hosting AS Pay with Vipps for WooCommerce
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-93547 CVE record

CVSS 5.3 Medium

Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells
- vaadin
- vaadin-spreadsheet-flow
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-97285 CVE record

CVSS 5.4 Medium

WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability
- Nexcess The Events Calendar
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-97282 CVE record

CVSS 5.3 Medium

WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability
- RadiusTheme Review Schema
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-97267 CVE record

CVSS 4.3 Medium

WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability
- miniOrange Prevent files / folders access
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-97247 CVE record

CVSS 6.5 Medium

WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability
- Creative Themes Blocksy Companion
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-97243 CVE record

CVSS 5.4 Medium

WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability
- flexyma AllAble Connector
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-97239 CVE record

CVSS 6.5 Medium

WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability
- Jose Conti MCP Content Manager Lite
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-97197 CVE record

CVSS 7.5 High

WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability
- WebToffee WordPress Backup & Migration
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-97079 CVE record

CVSS 4.3 Medium

WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability
- Webba Appointment Booking Webba Booking
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-97078 CVE record

CVSS 5.3 Medium

WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability
- BoldGrid Client Invoicing by Sprout Invoices
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-97074 CVE record

CVSS 4.3 Medium

WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability
- Newsletters, Email Marketing, SMS and Popups by Omnisend
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-97066 CVE record

CVSS 5.3 Medium

WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability
- Nexcess GiveWP
- Broken access control
Not analysed yet 30 Sept 2026